Chat now with support
Chat with Support

Change Auditor 7.3 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Azure Active Directory Defender Office 365 Logon Activity Skype for Business Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level SQL Extended Events Threat Detection

Logon Activity

* 
NOTE: By default, Logon Activity reports include the Logon Type, Logon Start, Logon End, Logon Session Start, Logon Session End and Logon Duration columns on the Search Results page. These additional columns are defined using the Layout tab.
All Kerberos service ticket events for unsafe encryption type in the last 7 days
Who = All Users
What = A Kerberos service ticket was created with an unsafe encryption type
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Failed Logons in the last 7 days
Who = All Users
What = User failed to authenticate through Kerberos, User failed to authenticate through NTLM, User failed to log on interactively, User failed to log on interactively from a remote computer, User failed to perform a network logon from a remote computer
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Interactive Logons in the past 24 hours
Who = All Users
What = User failed to log on interactively; User logged on interactively
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All Kerberos Authentication Activity in the past 24 hours
Who = All Users
What = User authenticated through Kerberos, User failed to authenticate through Kerberos
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All Kerberos user ticket events that exceed the maximum ticket lifetime in the past 30 days
Who = All Users
What = Kerberos user ticket that exceeds the maximum ticket lifetime detected
Where = All sources
When = Last 30 days
Origin = All workstations/servers
All Logons by administrators in the past 24 hours
Who = Administrators
What = Authentication Activity; Domain Controller Authentication; Logon Session
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All Logons in the past 24 hours
Who = All Users
What = Authentication Activity; Domain Controller Authentication; Logon Session
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All NTLM Authentication Activity in the past 24 hours
Who = All Users
What = User authenticated through NTLM, User failed to authenticate through NTLM
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All NTLM version 1 logons in the last 7 days
Who = All Users
What = User performed a successful NTLM V1 logon
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All Remote Interactive Logons in the past 24 hours
Who = All Users
What = User failed to log on interactively from a remote computer; User failed to perform a network logon from a remote computer; User logged on interactively from a remote computer; User performed a successful network logon from a remote computer
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All User Sessions in the past 24 hours
Who = All Users
What = Logon Session facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers

Skype for Business

All back-end server changed events in the last 7 days
Who = All Users
What = Skype for Business: Topology - Back end server changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All connection point created events in the last 7 days
Who = All Users
What = Skype for Business: Connection point created
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All connection point deleted events in the last 7 days
Who = All Users
What = Skype for Business: Connection point deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Skype for Business events in the last 7 days
Who = All Users
What = Skype for Business Administration facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Skype for Business user events in the last 7 days
Who = All Users
What = Skype for Business: User enabled attribute changed; Skype for Business: User enabled options changed; Skype for Business: User line server changed; Skype for Business: User policy changed; Skype for Business: User primary address changed; Skype for Business: User SIP or Phone URI changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All member added to Skype for Business administration group events in the last 7 days
Who = All Users
What = Member added to Skype for Business administration group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All member removed from Skype for Business administration group events in the last 7 days
Who = All Users
What = Member removed to Skype for Business administration group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All user enabled attribute changed events in the last 7 days
Who = All Users
What = Skype for Business: User enabled attribute changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All user enabled options changed events in the last 7 days
Who = All Users
What = Skype for Business: User enabled options changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All user line server changed events in the last 7 days
Who = All Users
What = Skype for Business: User line server changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All user policy changed events in the last 7 days
Who = All Users
What = Skype for Business: User policy changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All user primary address changed events in the last 7 days
Who = All Users
What = Skype for Business: User primary address changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All user SIP or Phone URI changed events in the last 7 days
Who = All Users
What = Skype for Business: User SIP or Phone URI changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Recommended Best Practices

The Recommended Best Practices reports are available under the following folders:

•
Auditing Service Administrator Activity
•
Domain Controller Changes
•
Domain-Level Changes
•
Exchange
•
Forest-Level Changes
•
Severity Based Changes
•
SQL

Auditing Service Administrator Activity

The Auditing Service Administration Activity reports are available under the following folders:

•
Domain Wide Configuration Activity | Domain Admins
•
Forest Changes by Activity
•
Forest Wide Configuration Activity | Enterprise Admins
•
Forest Wide Configuration Activity | Schema Admins
•
Service Admins Group Membership
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating